CVE-2025-3944: high-severity vulnerability in Tridium Niagara Framework
Incorrect Permission Assignment for Critical Resource
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.5%
Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Related CVEs — Tridium Niagara Framework
In the same product, most dangerous first.
CVE-2025-3943MEDIUMUse of GET Request Method With sensitive Query StringsEPSS 11.4%CVE-2025-3945HIGHImproper Neutralization of Argument Delimiters in a Command (‘Argument Injection’)EPSS 0.6%CVE-2025-3941MEDIUMImproper Handling of Windows: DATA Alternate Data StreamEPSS 0.5%CVE-2025-3940MEDIUMImproper Use of Validation FrameworkEPSS 0.4%CVE-2025-3936MEDIUMIncorrect Permission Assignment for Critical ResourceEPSS 0.4%CVE-2025-3937HIGHUse of Password Hash with Insufficient Computational EffortEPSS 0.3%